CVE-2026-54659

CVE-2026-54659 targets Pagy::I18n.locale= and is classified as a file-existence oracle rather than a path traversal with direct content exfiltration. The distinction matters: an attacker can probe whether arbitrary files exist and are readable on the server by observing application behavior differences when locale values are set, but cannot directly retrieve file contents through this mechanism. The actual severity of this vulnerability is not fixed by the CVE — it depends entirely on what your application or Pagy does with the YAML locale content after loading. If the loaded locale hash gets merged into templates without sanitization, you have XSS. If it gets passed to eval or instance_eval somewhere in the locale processing chain, you have RCE. If it's simply loaded and discarded, you have information disclosure about filesystem contents. The CVE description does not specify which consumption pattern is operative, and that gap is the critical uncertainty. Affected versions span 43.0.0 through 43.5.6 — six minor versions, suggesting this was introduced during a refactor of the i18n module in version 43.0.0 and caught relatively quickly. The patch in 43.5.6 addresses the path component, but verify whether your integration pattern involves additional locale processing that could still consume untrusted input. If you're using Pagy with Rails, check whether Rails' i18n layer validates locale parameters before they reach Pagy::I18n.locale=. Many Rails applications apply controller-level validation that may buffer this oracle, but this is not guaranteed across all configurations. Audit any code that receives the loaded locale hash — especially if you have custom locale loaders, template helpers that process locale data, or gem extensions that manipulate i18n state. The six-version window is narrow by CVE standards, but any application deployed on versions 43.0.0–43.5.6 with unpatched dependencies carries this oracle and should be evaluated for downstream locale processing paths that could escalate impact beyond information disclosure.

Reviewed through automated stages and approved by a human before publication.